IN-BROWSER PASSWORD VETTING
Passwords are vetted by a web browser before the passwords are submitted to an enterprise for use. A set of password groups is generated, where each password group in the set is associated with one or more security constraints to be satisfied by passwords for access to protected resources of the enterprise. The web browser vets a password that is new or modified. Vetting the password includes, by the web browser, determining a first password group of the set of password groups to which the password belongs and determining if the password satisfies one or more first security constraints associated with the first password group. If the password satisfies the one or more first security constraints, the web browser accepts the password for use. If the password does not satisfy the one or more first security constraints, the web browser blocks the password.
1 . A method comprising:
generating a set of password groups, wherein each password group in the set is associated with one or more security constraints to be satisfied by passwords for access to protected resources of an enterprise; and
vetting, by a web browser, a password, wherein the password is a new or modified password, wherein vetting the password comprises, by the web browser,
determining a first password group of the set of password groups to which the password belongs;
determining if the password satisfies one or more first security constraints associated with the first password group;
based on determining that the password satisfies the one or more first security constraints, accepting the password for use; and
based on determining that the password does not satisfy the one or more first security constraints, blocking the password.
2 . The method of claim 1 , wherein the one or more first security constraints comprise at least one of a minimum password strength for passwords within the first password group and a maximum number of accounts for which passwords within the first password group may be reused.
3 . The method of claim 2 , wherein determining if the password satisfies the one or more first security constraints comprises at least one of determining if a strength of the password is greater than or equal to the minimum password strength and determining if the password has been overused based on reuse of the password exceeding the maximum number of accounts for which passwords within the first password group may be reused.
4 . The method of claim 1 , wherein determining if the password satisfies the one or more first security constraints associated with the first password group comprises determining if the password has previously been leaked.
5 . The method of claim 4 , wherein determining if the password has previously been leaked comprises searching a database that lists passwords that have been leaked for the password.
6 . The method of claim 4 , wherein determining if the password has previously been leaked comprises determining a distance between the password and a known leaked password and determining if the distance is less than a predetermined distance, wherein determining the distance between the password and the known leaked password comprises determining at least one of a Levenshtein distance, a Hamming distance, and a cosine distance between the password and the known leaked password.
7 . The method of claim 1 , further comprising, for each password group in the set of password groups, determining the one or more security constraints associated with the password group, wherein the one or more security constraints comprise at least one of a minimum password strength for passwords within the password group and a maximum number of accounts for which passwords within the password group may be reused, wherein determining at least one of the minimum password strength for passwords within the password group and the maximum number of accounts comprises determining at least one of the minimum password strength and the maximum number of accounts based on at least one of metadata of the password group and one or more features of users whose passwords belong to the password group.
8 . The method of claim 1 , further comprising the web browser intercepting the password for vetting, wherein vetting the password is performed prior to communicating the password to the enterprise to accept the password for use and/or during composition of the password in the web browser.
9 . The method of claim 1 , wherein the set of password groups comprises password groups for at least one of users within the enterprise, users within a plurality of departments of the enterprise, a plurality of user roles, a plurality of user security clearance levels of the enterprise, a plurality of resource confidentiality levels of the enterprise, a plurality of cyberattack vulnerability assessments for user equipment of the enterprise, a plurality of cyberattack vulnerability assessments for software configurations of the enterprise, non-SSO (single sign-on) passwords of the enterprise, shared passwords, and passwords that are not used for interacting with the enterprise.
10 . The method of claim 1 , wherein determining the first password group of the set of password groups to which the password belongs comprises determining the first password group based on at least one of whether the password corresponds to a personal service or a corporate service, whether the password corresponds to an identity provider (IdP) service, and whether the password corresponds to a sensitive or non-sensitive service.
11 . One or more non-transitory computer-readable media having program code stored thereon, the program code comprising instructions to:
generate a set of password groups, wherein each password group in the set is associated with one or more security constraints to be satisfied by passwords for access to protected resources of an enterprise; and
vet, by a web browser, a password, wherein the password is a new or modified password, wherein the instructions to vet the password comprise instructions to, by the web browser,
determine a first password group of the set of password groups to which the password belongs;
determine whether the password satisfies one or more first security constraints associated with the first password group;
based on a determination that the password satisfies the one or more first security constraints, accept the password for use; and
based on a determination that the password does not satisfy the one or more first security constraints, block the password.
12 . The non-transitory computer-readable media of claim 11 , wherein the one or more first security constraints comprise at least one of a minimum password strength for passwords within the first password group and a maximum number of accounts for which passwords within the first password group may be reused.
13 . The non-transitory computer-readable media of claim 12 , wherein the instructions to determine whether the password satisfies the one or more first security constraints comprise at least one of instructions to determine whether a strength of the password is greater than or equal to the minimum password strength and instructions to determine whether the password has been overused based on reuse of the password exceeding the maximum number of accounts for which passwords within the first password group may be reused.
14 . The non-transitory computer-readable media of claim 11 , wherein the instructions to determine whether the password satisfies the one or more first security constraints associated with the first password group comprise instructions to determine whether the password has previously been leaked.
15 . The non-transitory computer-readable media of claim 11 , wherein the program code further comprises instructions to, by the web browser, intercept the password for vetting, wherein the instructions to vet the password comprise instructions to vet the password prior to communication of the password to the enterprise to accept the password for use and/or during composition of the password in the web browser.
16 . The non-transitory computer-readable media of claim 11 , wherein the instructions to determine the first password group of the set of password groups to which the password belongs comprise instructions to determining the first password group based on at least one of whether the password corresponds to a personal service or a corporate service, whether the password corresponds to an identity provider (IdP) service, and whether the password corresponds to a sensitive or non-sensitive service.
17 . A user equipment comprising:
a processor; and
a machine-readable medium having instructions stored thereon that are executable by the processor to cause the user equipment to,
generate a set of password groups, wherein each password group in the set is associated with one or more security constraints to be satisfied by passwords for access to protected resources of an enterprise; and
vet, by a web browser, a password, wherein the password is a new or modified password, wherein the instructions executable by the processor to cause the user equipment to vet the password comprise instructions executable by the processor to cause the user equipment to, by the web browser,
determine a first password group of the set of password groups to which the password belongs;
determine if the password satisfies one or more first security constraints associated with the first password group;
based on a determination that the password satisfies the one or more first security constraints, accept the password for use; and
based on a determination that the password does not satisfy the one or more first security constraints, block the password.
18 . The user equipment of claim 17 , wherein the one or more first security constraints comprise at least one of a minimum password strength for passwords within the first password group and a maximum number of accounts for which passwords within the first password group may be reused, wherein the instructions executable by the processor to cause the user equipment to determine if the password satisfies the one or more first security constraints comprise at least one of instructions executable by the processor to cause the user equipment to determine if a strength of the password is greater than or equal to the minimum password strength and instructions executable by the processor to cause the user equipment to determine if the password has been overused based on reuse of the password exceeding the maximum number of accounts for which passwords within the first password group may be reused.
19 . The user equipment of claim 17 , wherein the instructions executable by the processor to cause the user equipment to determine if the password satisfies the one or more first security constraints associated with the first password group comprise instructions executable by the processor to cause the user equipment to determine if the password has previously been leaked.
20 . The user equipment of claim 17 , further comprising instructions executable by the processor to cause the user equipment to, by the web browser, intercept the password for vetting, wherein the instructions executable by the processor to cause the user equipment to vet the password comprise instructions executable by the processor to cause the user equipment to vet the password prior to communication of the password to the enterprise to accept the password for use and/or during composition of the password in the web browser.